Claude mods join the permission chain before the classifier
Mods are released and enabled by default in 2.1.287, which ignores the old environment off switch. At cutoff, stable is 2.1.287 and latest is 2.1.296. Admitted mod code can replace an ask or non-managed hook block and, in auto mode, skip the classifier. Deny precedence depends on the built-in guard loading under managed settings or Team/Enterprise sign-in, with allowModsToOverrideDenyRules left false; mods' own process and file calls remain outside tool rules. Ask and environment holds are main-only.
What this changes for operators
- Managed fleets: use latest 2.1.296 and set managed pluginConfigs[“cc-plugin-sec-default@builtin”].options.allowManagedModsOnly to true. Stable lacks later guard repairs. Before adding disableSideloadFlags, check CI invocations: it also rejects --agents and --mcp-config.
- Unmanaged users: inspect claude plugin validate for tool.check, then review or remove untrusted mods, or use --safe-mode or --settings ‘{“disableAllHooks”:true}’; built-in mods remain. CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=0 is ineffective from 2.1.287. Keep whole-process containment because mods are unsandboxed.
- Plugin admission now requires reviewing code that can answer permission questions. A released binary containing the main guard’s ask and environment holds, plus mode-specific denial tests, would settle that narrower repair; it would not turn the guard into hostile-code isolation.
Primary sources
- github_release 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them anthropics/claude-code / v2.1.287
- tagged_commit_file 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them anthropics/claude-code / mods/sec-default/hooks/register.ts#L67-L114
- official_docs 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them code.claude.com/docs/en/permissions#extend-permissions-with-hooks
- official_docs 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them code.claude.com/docs/en/plugins/mods/admin
- git_compare 2026-10-13-claude-code-unreleased-on-main-after-2-1-296-the-mods-guard-extends-to-ask-verdicts-and-pins-policy github.com/anthropics/claude-code/compare/v2.1.296...bf2323b3021c9d3db7a31e1e7d61068c3f704497
- tagged_commit_file 2026-10-13-claude-code-unreleased-on-main-after-2-1-296-the-mods-guard-extends-to-ask-verdicts-and-pins-policy anthropics/claude-code / mods/sec-default/README.md
- tagged_commit_file 2026-10-13-claude-code-unreleased-on-main-after-2-1-296-the-mods-guard-extends-to-ask-verdicts-and-pins-policy anthropics/claude-code / mods/sec-default/README.md
Signal metadata
Source findings
- 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them 2026-10-13-claude-code-mods-ship-on-by-default-in-2-1-286-and-can-approve-tool-calls-deny-rules-hold-over-them
- 2026-10-13-claude-code-unreleased-on-main-after-2-1-296-the-mods-guard-extends-to-ask-verdicts-and-pins-policy 2026-10-13-claude-code-unreleased-on-main-after-2-1-296-the-mods-guard-extends-to-ask-verdicts-and-pins-policy
Featured in
- The Handoff Has an API / 2026-10-13
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-10-13-claude-code-mods-can-answer-permission-checks
Research evidence and publication history are open in the repository.